fix(consensus): bound ancestry walk, fix partial tx IDs, enforce lock ordering, fix poll mutex

[wpank]

Summary

Fixes four consensus-layer issues that can cause unbounded memory growth, duplicate transactions, potential deadlocks, and unnecessary mutex contention:

• #113 -- Bound ancestry walk in verify: The verify method collected all unverified blocks from the ancestry stream into an unbounded Vec. After a prolonged disconnect, this could consume arbitrary memory. Now bounded to MAX_ANCESTRY_WALK (1024 blocks); verification fails if the limit is exceeded, deferring to catch-up / state-sync for recovery.

• #149 -- collect_ancestor_tx_ids returns error on snapshot gap: LedgerView::collect_ancestor_tx_ids previously returned a partial BTreeSet when a snapshot was missing from the chain, silently ignoring the gap. The caller would then build a block with an incomplete excluded set, risking duplicate transactions. Now returns Option<BTreeSet<TxId>> and propagates None to callers so they can abort the proposal.

• #151 -- Enforce uniform RwLock ordering in InMemorySnapshotStore: Multiple methods acquired snapshots, persisted, and persisted_order RwLock guards in different orders, creating a potential deadlock. All multi-lock methods now follow the canonical order: persisted -> persisted_order -> snapshots.

• #153 -- Release ledger mutex during wait_for_snapshot polling: wait_for_snapshot re-acquired the async Mutex<LedgerState> on every poll iteration, causing thundering-herd contention when multiple waiters were notified simultaneously. Now clones the InMemorySnapshotStore handle (which is backed by Arc<RwLock<..>>) once under the mutex and uses it directly for subsequent checks, eliminating the per-iteration mutex acquisition.

Test plan

• Existing unit tests in kora-consensus and kora-ledger pass (cargo test -p kora-consensus -p kora-ledger)
• cargo check --workspace passes
• cargo clippy --workspace --no-deps -- -D warnings passes
• Review ancestry walk bound (1024) is sufficient for normal operation while preventing OOM
• Review that build_proposal_txs callers handle the new Option return type correctly

🤖 Generated with Claude Code